gathered and turned over video surveillance and provided intelligence on various Metrorail

2

stations in the Washington, D.C. area, in preparation for what he believes to be an upcoming simultaneous Al-Qaeda explosives attack on the Metrorail system.

6. In January 2010, the FBI learned that AHMED and an associate were inquiring about making contact with a terrorist organization in order to participate in jihad by traveling overseas to fight coalition forces in Afghanistan and/or Pakistan. I have seen an e-mail received by AHMED and his associate in April 2010, that notified AHMED that he could meet an individual that AHMED believed to be a representative of a terrorist organization at a hotel near the Washington-Dulles International Airport on April 18, 2010.

7. On April 18, 2010, FBI agents observed AHMED receive a Koran from another individual in the lobby of a hotel near the Washington-Dulles International Airport. Before AHMED received the Koran, I saw that it contained documents providing code words for locations to be used for future meetings. I saw e-mail messages that indicated, in code, that AHMED planned to meet an individual that AHMED believed to be a representative of a terrorist organization on May 15,2010, at a hotel in Northern Virginia.

8. On May 15,2010, AHMED met with an individual he believed to be a terrorist operative in a hotel room in Northern Virginia. The entire meeting was captured by audio and video surveillance conducted by the FBI, and the conversation that was recorded was translated into English. At this meeting, the individual who AHMED believed to be a terrorist operative (hereinafter "Operative-l ") asked AHMED why AHMED had come to see him. AHMED replied that he wanted to fight and kill Americans in Afghanistan. When Operative-I asked AHMED to clarify whether he wanted to become a martyr, AHMED responded "of course" and stated that he wanted to fight.

3

9. At the meeting, Operative-l told AHMED that his organization would require certain tasks to be completed during the next six months in preparation for an operation. These tasks would include gathering information on specific locations in the Washington, D.C. area, including the Arlington Cemetery Metrorail station and a hotel in Washington, D.C. The surveillance video and the translation of the suveillance audio reveals that AHMED agreed to gather such information and report back to Operative-I.

10. On the afternoon of July 7, 2010, FBI surveillance observed AHMED and an associate enter the Dunn-Loring-Merrifield Metrorail station, and then exit at the Arlington Cemetery Metrorail station. FBI agents later observed them returning to the Arlington Cemetery Metrorail station and boarding a train.

II. On the afternoon of July 13, 20 I 0, FBI surveillance observed AHMED and an associate purchase tickets at the Dunn-loring-Merrifield Metrorail station. FBI agents observed them arrive at the Arlington Cemetery Metrorail station shortly thereafter, walk towards the exit escalator, return to the opposite side of the platform, and depart the station.

12. On July 19,2010, AHMED again met in a hotel room with Operative-I. Once again, the entire meeting was captured by audio and video surveillance conducted by the FBI, and the recorded conversation was translated into English. The video and translated audio footage reflects that AHMED told Operative-I that AHMED had gone to the Arlington Cemetery Metrorail station and completed one of the two tasks that Operative-I had provided him. AHMED told Operative-I that, if you come from outside the cemetery there are guards standing there, and when you come from inside the station there is a security camera and then a security guard.

4

13. At the meeting, AHMED also provided Operative-l with a thumb drive which AHMED stated contained recorded video of the Arlington Cemetery Metrorail station. AHMED explained that he and an associate used a mobile phone video camera, holding the phone up as though talking on the phone and not recording. Operative-I then explained to AHMED that his information-gathering was in preparation for an attack on a total of four locations, including the Arlington Cemetery. Courthouse, and Pentagon City Metrorail stations, and a hotel in Washington, D.C. According to the surveillance footage, AHMED replied that those were good targets that contained many people. AHMED agreed to continue gathering information on the targets as he did for the Arlington Cemetery Metrorail station.

14. On the afternoon of August 22, 2010, FBI agents observed AHMED and an associate enter the Dunn-Loring-Merrifield Metrorail station and board an eastbound train. Shortly thereafter, FBI agents observed them proceed up the escalator at the Courthouse Metrorail station and then later return to the platform to board an eastbound train. Shortly thereafter, FBI agents observed them at the Rosslyn Metrorail station, the Pentagon City Mall, and at the Pentagon City Metrorail station.

15. On September 28, 2010, Ahmed and Operative-I again met in a hotel room

in Northern Virginia. Once again, the entire meeting was captured by audio and video surveillance conducted by the FBI, and the conversation that was recorded was translated into English. Upon AHMED's arrival, Operative-I introduced AHMED to another individual who represented himself as the boss of Operative-I. The surveillance footage reflects that this newly introduced individual (hereinafter "Operative-Z"), asked AHMED if AHMED knew the identity

5

of the organization to which Operative-l and Operative-2 belonged; AHMED said - - and then repeated - - that he understood them to belong to Al-Qaeda.

16. The surveillance video and translated video reflect that, at the meeting on September 28,2010, AHMED provided Operative-I and Operative-2 with a thumb drive containing videotaped images of the Courthouse and Pentagon City Metrorail stations, and told them that he had completed all the tasks except for one (a hotel in Washington. D.C.).

17. The surveillance tapes reflect that Operative-2 told AHMED that the organization was planning to attack these sites some time in 2011. AHMED described the entrances and general layouts of the stations, and stated that between 4:00 p.m. and 5:00 p.m. would be the best time to stage an attack to cause the highest number of casualties. AHMED also sketched and provided to Operative-l and Operative-2 a written diagram of each Metrorail station on three small pieces of paper, and provided suggestions on where to place explosives at each location to kill the most people.

18. The surveillance tapes further reflect that AHMED was shown three backpacks and asked which would be the most conducive for the attacks. AHMED tried one of them on and explained that, although the backpacks would work, it would be better to use wheeled suitcases. AHMED stated that he wanted to kill as many military personnel as possible, and suggested an additional attack on the Crystal City Metrorail Station. AHMED offered to provide the bombers with Metrocards and to conduct surveillance on the Crystal City Metrorail station.

19. The surveillance tapes reveal that AHMED told Operative-I and Operative-2 that AHMED wished to fight injihad himself, and that he has trained to do so using various firearms. AHMED previously discussed the various firearms he has used andlor purchased (including rifles

6

and a shotgun) and stated that he had been to a shooting range. AHMED also noted that he had

studied martial arts for four years, learned knife and gun techniques, and learned disarming

techniques. AHMED said that he could teach these skills to others and indicated that he could

purchase additional firearms.

20. As part of the investigation, the FBI has learned that AHMED purchased and/or

attempted to purchase firearms in May 2008 and in February 2009. Accordingly, I believe that

AHMED is using his firearms to train for his ultimate goal of traveling to Afghanistan to fight

and kill Americans, and that he could train and purchase other weapons for members of

Al-Qaeda. My belief that AHMED is using his firearms to train for this purpose is corroborated

by statements that AHMED made to Operative-I and Operative-2 that he planned to travel to

engage in jihad after his upcoming trip for the "hajj" - - which I know to refer to a trip to Saudi

Arabia. For example, AHMED told Operative-Ion May 15,2010 that he might be ready to

----

travel overseas to conduct jihad in January 2011 after he had completed the Hajj pilgrimage in

November 2010. Further, on September 28, 2010, AHMED told both Operative-I and

Operative-2 that he was attending the Hajj this year and that they should all go in order to

complete the five pillars of Islam before making the "top mark" - - by which I believe AHMED

meant "becoming a martyr." As a result, AHMED's travel documents are likely to reflect that

trip, and corroborate his statements to Operative-I and Operative-2

21. In his meetings with Operative-l and Operative-Z, AHMED also discussed his desire

to provide financial assistance to mujahadeen in general and to their organization in specific. For

example, during AHMED's meeting with Operative-I on july 19, 20}0, AHMED stated that he

wanted to donate money to support their brothers overseas and would collect donations even ifhe

7

had to do it in the name of another cause. AHMED explained that he could provide $10,000 and would send it to the organization in increments of$I,OOO in order not to raise any red flags. Accordingly, AHMED's financial documents are likely to reflect any attempts to provide financial support for terrorists.

22. Based on my knowledge, training and experience, as well as that of other agents assigned to this investigation from the FBI, I know that individuals generally keep records of their financial accounts, if for no other reason than as proof of their holdings. These records are usually kept in the individual's home or office. In the course of this investigation, I have seen records of financial accounts that were mailed to AHMED at his residence. Accordingly, I believe that he is likely to keep records of his financial accounts in his home.

AHMED's Residence

23. During the course of this investigation, FBI physical surveillance observed AHMED driving a green four-door Honda Accord, bearing Virginia license plate XVM-4782, to conduct surveillance on the Metrorail stations, and to the meetings with Operative-l and Operative-2. Virginia Department of Motor Vehicles ("DMV") records reflect that the vehicle bearing the tags XVM-4782 is a 2005 Honda Accord with the vehicle identification number ("V IN")

24. On September 28, 2010, an FBI agent observed AHMED entering the residence at __ Nashua Street in Ashburn, Virginia, after exiting his green Honda Accord. Between March 2010 and October 2010, the FBI conducted physical surveillance at ~ Nashua Street,

8

in Ashburn, Virginia, approximately thirteen times. This surveillance often observed AHMED's vehicle at the residence, and he and his spouse entering and exiting the residence.

25. Based on the DMV records and this physical surveillance, I know that AHMED

resides at the real property and premises known as Nashua Street, in Ashburn, Virginia.

FBI agents who surveilled AHMED at that residence advised me that the residence at b Nashua Street in Ashburn, Virginia, is a three-story red brick townhouse, attached by another townhouse on either side, located east of Plainfield Street, along the north side of Nashua Street. The townhouse is identified by the black numbers _" affixed to the off-white doorframe, immediately to the right of the dark gray front door, which is at the top of the stairs that lead from the sidewalk.

26. As noted above, AHMED received a Koran on April 18, 2010, containing documents providing code words for locations to be used for future meetings. Based on the translations of the recordings of AHMED's conversations with Operative-I and Operative-2, I know that AHMED is very security conscious. I know that individuals generally keep items they want to keep safe in their home or other place to which they have ready access. I believe that AHMED is likely keeping the Koran and the information detailed in the coded documents at his residence.

27. At both the second meeting with Operative-l in July 2010, and at the meeting with Operative-I and Operative-Z in September 2010, AHMED provided a thumb drive containing video footage of the various Metrorail stations. Inasmuch as AHMED provided surveillance footage of Metrorail stations on thumb drives, he is likely to use and maintain computer equipment. Further, AHMED explained that the Metrorail station sites were filmed using a cellular phone camera and that some of the videos had to be destroyed. Accordingly, AHMED

9

must be utilizing a computer or similar electronic device to view, edit, and/or delete the videos that were taken at the Metrorail stations. Since AHMED would likely need some privacy to be viewing these locations, it is likely he conducted these computer operations at his home. Based on my training and experience, he is likely to use and maintain such a computer in his residence.

28. I know from my training and experience that even information deleted by most computer users can be retrieved from a computer long after the computer user commanded the computer to delete the information.

29. I have been advised that proper retrieval and analysis of electronically stored data, and to insure the accuracy and completeness of such data and to prevent the loss of the data either from accidental or programmed destruction, requires both on-site and laboratory analysis by a qualified computer specialist. To effect such accuracy and completeness requires the seizure of all computer equipment and peripheral devices which may be interdependent, the software to operate them, and related instruction manuals which contain directions concerning the operation of the computer system and software programs. I also know that it is often necessary to physically remove computers from the location where they were located. Often the physical removal may be necessary for several reasons, including the protection of the data for both investigative purposes as well as allowing for the safe return of the computer (its data) to the person from which it was seized.

Bank Account

30. In the course of this investigation, I have seen records obtained from BB&T Bank.

These records reflect that AHMED is the accountholder for Account Number •• 0771, in the name of Farooque Ahmed. at BB&T Bank, that I believe to be located at 2221 South Eads Street,

10

in Arlington, Virginia. J also have seen a check written by AHMED on that account in July

2010.

Conclusion

31. Based on the foregoing information, I submit that probable cause exists to believe

that located within the real property and premises known ~ Nashua Street, in Ashburn,

Virginia, are evidence, fruits, and instrumentalities, as more particularly described in Attachment

A, of an attempt to provide material support to a designated terrorist organization, in violation of

18 U.S.C. § 23398

32. I am advised that a violation of 18 U.S.C. § 2339B constitutes a "Federal crime of

terrorism" as defined in 18 U.S.C. § 2332b(g)(S). Accordingly, based on the foregoing, there

also is probable cause to believe that the following properties are subject to seizure and forfeiture

to the United States pursuant to 18 U.S.C. § 981 (a)(1 )(0), on the grounds that they constitute

assets of an individual engaged in planning a Federal crime of terrorism against the United

States, citizens or residents of the United States, or their property:

The above paragraphs include all of the foregoing items of evidence in whatever form and by whatever means such materials, their drafts, or their modifications may have been created or stored, including electronic or magnetic storage.

ACCOUNT ""'0771, IN THE NAME OF FAROOQUE) AHMED. AT BB&T 8ANK, 2221 SOUTH EADS STREET. ) ARLINGTON. VIRGINIA

CLERK US DISTRICT COURT _6.liXANDRIA. VIRGiNIA Case No. 1:10-sw- 5"~,

WARRANT TO SEIZE PERSONAL PROPERTY SUBJECT TO CIVIL FORFEITURE

To:

Any authorized law enforeement officer

An applicauon by a federal law enfortement ofncer or an anorney for the government requests that certain

property located in the Eastem District of Viralnia be seized as

being subject to forfeiture to the United States of America. The propeny is described as follows:

ALL MONIES AND OTHER THINGS OF VALUE IN ACCOUNT 1# • 0771, IN THE NAME OF FAROOQUE AHMED.

AT 88&T BANK. 2221 SOUTH EAOS STREET, ARLINGTON. VIRGINIA

I find that the affidavit(s) and any recorded testimony establish probable cause to seize the propeny.

YOU ARE COMMANDED to execute this warrant and seize the property on or before _ji~vember 8,2010 _ (No"o ':l~"d 10 dtI)·S)

r at any time in the day or night, as I flnd reasonable cause has been established.

I5l in the daytime - 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must also give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the propeny was taken, or leave the copy and receipt at the place where the property was taken.

An officer present during the execution of the warrant must prepare, as required by law, an inventory of any property seized and the officer executing the warrant must promptly return this warrant and a copy oflhe inventory 10

United Slates Magis'rate Judge John F. Anderson

(tlDlJI~)

r J find thai immediate notification may have an adverse result listed in 18 U.S.C. § 270S (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be

An application by a federal law enforcement officer or an anomey for the government requestS that certain

property located in the Eastem District of Viralnla be seized as

being subject to forfeiture to the United States of America. The property is described as follows:

ALL MONIES AND OTHER THINGS OF VALUE IN ACCOUNT tI 0771, IN THE NAME OF FAROOQUE AHMED.

AT BB&T BANK, 2221 SOUTH EADS STREET, ARLINGTON, VIRGINIA

I find that the affidavit(s) and any recorded testimony establish probable cause to seize the property.

YOU ARE COMMANDED 10 execute this warrant and seize the property on or before November 8.2010 (NOllo t:tcttd 10 dtIJ·s)

r at any time in the day or night, as I find reasonable cause has been established.

~ in the daytime - 6:00 a.m. to 10:00 p.m.

Unless delayed notice is authorized below, you must also give a copy of the wamnt and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken.

An officer present during the execution ofthe warrant must prepare, as required by taw, an inventory of any property seized and the officer executing the warrant must promptly return this warrant and a copy of'the inventory 10

United States Magistrate Judge John F. Anderson

(MIMJ

11 find thai immediate notification may have an adverse result Iisled in 18 U.S.C. § 2705 (except for delay of trial), and authorize the officer executing this warrant to delay netlee to the person who, or whose property, will be